PT-2021-1850 · Cisco · Cisco Data Center Network Manager

Published 2021-01-20 · Updated 2021-01-27 · CVE-2021-1272

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager (DCNM) (affected versions not specified)

Description A vulnerability in the session validation feature could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) attack on a targeted system. This is due to insufficient validation of parameters in a specific HTTP request. An attacker could exploit this by sending a crafted HTTP request to an authenticated user of the DCNM web application, potentially gaining unauthorized access to the Device Manager application, which provides access to network devices managed by the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2021-00610

CVE-2021-1272

Affected Products

Cisco Data Center Network Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-1272 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dcnm-ssrf-F2vX6q5p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1272 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00610 · Security Note
• https://t.me/cibsecurity/22442 · Telegram Post